The AI Malware Panic Was Loud. The Numbers Were Quiet.

What Unit 42's ai malware analysis actually found#

Every cybersecurity vendor's content calendar has an AI malware slide by now, and most of them lean on the same stale story: attackers are using AI, so the threat has fundamentally changed shape. Palo Alto Networks' Unit 42 approached that story with a patient prowl instead of a press release, testing the claim against its own telemetry rather than repeating it, and the result is the most useful piece of ai malware analysis published this year, precisely because it refuses to be dramatic.

For its ai malware analysis, researcher Sara McBroom's team pulled together 405 unique malware samples that were marketed, coded or captioned as AI-enabled, drawn from Unit 42's WildFire analysis reports, VirusTotal Intelligence and published open-source research, collected between June 2024 and June 2025. The collection net was deliberately wide: anything from an LLM-powered ransomware agent to a cryptocurrency miner that simply used “ChatGPT” in its filename qualified for the dataset.

Then Unit 42 cross-checked all 405 hashes against Cortex XDR endpoint telemetry pulled from real, non-test customer tenants, running December 2024 to June 2025. That is where the story turns quiet.

Twelve samples, three percent of the dataset, ever touched a protected endpoint, and Palo Alto Networks products detected and blocked every single one that tried. The other 97% never left the laboratory: no victim, no ransom note, no incident report, just a hash sitting in a sandbox or a VirusTotal upload folder.

A hedgerow full of rustling does not mean a fox is actually hunting there, and a repository full of AI-labelled samples does not mean attackers have actually deployed them. That gap matters for anyone selling security services on the strength of an AI threat narrative.

For MDR providers, MSSPs, pentest shops and GRC teams writing about AI risk, the distinction is the whole pitch. Overstate it and every claim after it gets discounted by a buyer who has read the same report. Understate it and FunkSec, the one family that genuinely did make it through, becomes the exception nobody warned a client about.

The three costumes most AI malware is wearing#

Unit 42 sorted the 393 non-production samples into three categories, and none of them describe a criminal underground quietly perfecting an agentic attack in the undergrowth.

The largest group is proof-of-concept and research code: frameworks built to demonstrate a technique rather than compromise anyone. Unit 42 found LLM-powered ransomware frameworks with ransom addresses pointing at the Bitcoin Genesis Block, an address that cannot receive a recoverable payment, sitting alongside AI-assisted reconnaissance scripts built for conference demonstrations. Configuration files target localhost. Debug logging runs verbose. No real operator leaves that kind of trail.

The second category is security-vendor validation testing: breach-and-attack-simulation platforms and internal red teams deliberately uploading known AI-themed samples to check their own detection coverage. The submission pattern gives it away, multiple uploads of the same hash from the same organisation, clustered inside a single business day, in a single time zone.

The third is plain brand abuse: conventional malware wrapped in an installer that name-drops a popular AI product, the way a scammer might slap a famous logo on a fake charity email. The AI branding is a costume the malware wears to get past a curious victim's guard, not a capability actually doing any of the work.

Three categories, one shared trait: none of them require a defender to rethink detection. A sandboxed proof-of-concept is not a live threat, and a red team's own test upload was never meant to reach production in the first place, which is exactly the distinction good ai malware analysis is supposed to draw.

Reading the 97% the panic keeps skipping#

Say the number out loud and it sounds almost boring: ninety-seven percent. That is precisely the point. Fear travels faster than a footnote, and a report with 405 alarming sample names in its dataset makes better copy than one built around twelve.

The other reading matters just as much. AI-enabled malware is real, Unit 42 says so plainly, it is simply rarer in practice than the public sample count suggests. Palo Alto Networks queried the same 405 hashes against WildFire session data forwarded by Next-Generation Firewalls and Cortex XDR agents, covering June 2024 to June 2025, and found roughly 15 to 20 unique hashes in that network traffic too, about four percent. Every measurement the firm ran lands in the same narrow band.

That narrow band is the entire point of doing ai malware analysis properly rather than skimming a press release. The read for cybersecurity marketers, in folkfox's own experience with this audience: that narrow band is a gift, not a threat to your content plan. A quiet quarry is still worth naming precisely. Cite the twelve, not the four hundred and five, and a buyer who has scrolled past three panicked posts already this week will trust the next paragraph you write.

That is the same discipline behind folkfox's content marketing work for regulated security vendors: cite the source, quote the real figure, and let precision do the persuading a superlative never quite manages.

FunkSec: the one exception that turned real#

Twelve samples reached real endpoints, spanning five distinct malware families across organisations in three countries: FunkSec ransomware, a trojanised AI application, the Oyster backdoor, the Rhadamanthys stealer and a COM-hijacking DLL. One of those five families did almost all of the damage, and separating it from the other four is the kind of close ai malware analysis a headline never has room for.

FunkSec is the most represented family in Unit 42's endpoint data: seven distinct ransomware variants, compiled between 1 and 6 January 2025, sharing a common Rust codebase and near-identical evasion habits, disabling Windows Defender, deleting volume shadow copies, changing the desktop wallpaper to display a ransom note. The PDB paths embedded in the binaries carry project names like Dev.pdb, Funksec.pdb, Darkzone.pdb and Darkfunk.pdb, the working notes of one developer iterating fast under several aliases. Seven builds in six days, Unit 42 writes, is a pace that suggests LLM-assisted development, closer to prompt generation than traditional software engineering, and every variant triggered a Cortex XDR alert on execution.

FunkSec is not a new name. Check Point Research first tracked the group in January 2025, when it published over 85 claimed victims in a single month, more than any other ransomware operation that December, and traced the malware's build environment to a path reading C:\Users\Abdellah\, alongside Rust source code that pointed to AI-assisted development from what SecurityWeek described as an inexperienced malware developer working out of Algeria. The group's published scripts carry code comments in flawless English, a striking mismatch against the broken English FunkSec used on its own criminal forums, exactly the seam a large language model tends to leave behind.

This is what a genuine exception looks like: named, dated, countable, and small enough that the rest of the 405-sample panic still does not hold up around it.

Capability is real. Deployment mostly isn't.#

None of this means AI cannot write working malicious code. It means writing malicious code and getting it past a defended network are two different problems, and criminals have mostly only solved the first one.

A July 2026 study out of the University of Naples Federico II tested AI-generated PowerShell malware against a curated dataset of genuine real-world samples and measured a median Jaccard index of 84.5% for behavioural overlap between the AI-generated code and authentic malware, with 48.4% of generated samples reaching a complete behavioural match. The capability is not theoretical, and it is not confined to one vendor's telemetry.

Where agentic execution genuinely arrived was not inside a malware sample at all. In November 2025, Anthropic disclosed that a state-linked group had used its Claude Code tool to automate 80 to 90% of a multi-stage espionage campaign against roughly 30 organisations, with a human directing only four to six critical decisions per operation. That is agentic execution as an operating model, not a file sitting on a disk, and it is the part of Unit 42's own title that a 97% headline tends to bury.

The pattern repeats across the rest of the threat-intelligence industry. CrowdStrike's 2026 Global Threat Report measured AI-enabled adversary operations up 89% year on year, and Google's Mandiant M-Trends 2026 clocked the median handoff between initial access and a second attacker collapsing from more than eight hours in 2022 to twenty-two seconds in 2025, helped along by malware like PROMPTFLUX querying an LLM mid-execution to rewrite its own evasion logic. None of that is AI writing a new class of malware. It is AI compressing the slow, boring parts of an attack that used to take a human all afternoon.

What real agentic risk looks like, and how to talk about it#

Google's Threat Intelligence Group separately reported disrupting a threat actor's attempt to use an AI-developed exploit in a planned mass vulnerability-exploitation operation in May 2026, evidence that the capability curve is real even where the malware-sample curve stays flat.

For a vendor writing to buyers who will read the Unit 42 report themselves, the safest ai malware analysis a vendor can publish is the boring one: keep ‘AI can write malicious code’ separate from ‘AI-written malware is beating our defences’, because Unit 42's own telemetry says the second claim is currently false for all but one family. Frame agentic risk the way folkfox covered NIST's own AI CSF guidance, against a named framework like the NIST AI Risk Management Framework or the detection logic catalogued in MITRE ATT&CK, rather than against a vibe.

It is the same posture folkfox has taken across this month's run of stories, from the funding chasing AI model security tooling to the vishing attack that caught an MDR provider's own staff and the jailbreak that went shopping for a weaker model: name the number, name the source, and let the reader do the panicking on their own time, if they still want to.

Unit 42 spent seven months tracking a sharp scent that led back to a sandbox nineteen times out of twenty. The one trail that led somewhere real had a name, a date and seven variants. That is the level of precision worth putting in a pitch deck, and it is considerably more persuasive than another slide warning that the robots are coming.

Frequently asked questions#